Every service that offers two-factor authentication shows you the same screen once, usually for about fifteen seconds of your attention: a block of eight or ten short strings, a button saying "I have saved these", and no second chance. Most people click the button. Almost nobody saves the codes. Then a phone gets stolen, reset or dropped in a sink, and those unsaved strings turn out to have been the only door left open.
Recovery codes are worth understanding properly, because they behave differently from every other credential you own. If you are still setting up two-factor on an account, you can generate and test the rolling six-digit part with a free online TOTP authenticator first, then deal with the backup codes as a separate, deliberate step.
What a recovery code actually is
A recovery code is a pre-generated, single-use secret that a service will accept instead of your second factor. It is not derived from your password and it is not derived from your authenticator seed. The server generated a batch of random strings when you enabled 2FA, stored their hashes, and showed you the plaintext exactly once.
That design has two consequences. The first is that the service genuinely cannot show them to you again — it does not have them any more, only hashes. The second is that anyone holding one of those strings can bypass your second factor completely. A recovery code is not a hint or a backup question. It is a full-strength key.
How they differ from TOTP codes
The six digits your authenticator app produces change every thirty seconds because they are computed from a shared secret and the current time. That is what a TOTP code is, and it is why it works offline and why it expires so fast.
Recovery codes are the opposite in almost every respect:
- They do not expire. A code printed in 2023 still works today unless you regenerated the batch.
- They are single-use. Using one burns it; the remaining ones stay valid.
- They are longer. Typically 8 to 16 characters, because they have to resist offline guessing without a 30-second window protecting them.
- They are finite. Ten is the usual batch. Burn all ten and you are back to support tickets and identity documents.
Where to store them
The storage problem is genuinely awkward: the codes must survive the loss of your phone, but must not sit anywhere an attacker who already has your password can reach. That rules out the two places people actually use — a note on the phone itself, and an email to yourself.
What works:
- A password manager, in a separate entry from the account. Not in the same login item, and ideally in a vault protected by a different master secret. If your manager is the thing you would lose, this is not enough on its own.
- Printed on paper, somewhere physical. Unfashionable and unbeatable. A folded sheet in a drawer at home survives phone loss, cloud lockout and SIM swaps at the same time. Write the service name on it; ten anonymous strings help nobody.
- An encrypted file on a USB stick or offline disk. Good if you already have that habit; a burden if you do not.
What does not work: screenshots in your camera roll (they sync to the cloud account you are trying to protect), plain text files in shared drives, chat messages to yourself, and the browser's autofill. If a code is somewhere your logged-in session can read it, it is somewhere an attacker with that session can read it too.
Whichever you choose, protect the container properly. A vault or an encrypted archive is only as strong as what opens it, which is a good reason to use a generated passphrase rather than something you invented for the master credential.
Using one, and what to do afterwards
At the 2FA prompt, look for "Use a backup code", "Try another way" or an equivalent link. Paste one code. You are in. Then do three things immediately, because the account is now in a weakened state:
- Re-enrol a second factor on your new device before you close the tab.
- Regenerate the whole batch. Most services offer this in security settings. It invalidates every old code, including any copy you no longer control.
- Review active sessions and app passwords and revoke anything you do not recognise.
If you have no codes left and no device, you are in the harder scenario covered in our guide to regaining access when your authenticator is gone — provider-specific recovery, identity checks, and days of waiting rather than minutes.
A ten-minute habit that prevents all of this
The next time any service shows you recovery codes, do not close the screen until the codes exist in two places that would not fail together. Then, once a year, spend ten minutes checking that the codes for your email, your password manager and your primary bank are still where you think they are, and that the count matches what the service says is unused.
Your email account deserves the most care here, since it is the reset path for everything else. That is also the argument for not routing every random signup through it in the first place — a disposable inbox for throwaway accounts keeps your real address, and its recovery codes, out of circulation entirely.
